MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b73eb50389b6053796e922d764b9fd8b94d90d21c8c885ae265e6092ed971dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b73eb50389b6053796e922d764b9fd8b94d90d21c8c885ae265e6092ed971dd8
SHA3-384 hash: 61a69471680fcf7be6b440bf15cac79e7b2da2e5a50570bab80af3bc60bf6fd2ea9f1ba17902c50d470b90eba49bf871
SHA1 hash: 7faa42550fb32f8ada9bced524e2e1970a0483a3
MD5 hash: 5ae073de5fa4ca34eca9bc0da2beaa5d
humanhash: delta-carolina-florida-double
File name:RFQ.7z
Download: download sample
Signature MassLogger
Create hunting rule
File size:860'408 bytes
First seen:2020-06-24 06:29:02 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:ViIhM5uCFN/CWfZeSYf0ohJKa66qsUW70Kdm3XE:oIy5JlCWBeSYppqs3UnE
TLSH 1F0533871309EBF8E49537BA0CD1DB4BE885118385C0DC60317CA6C7AB92EB91DB5DE6
Reporter abuse_ch
Tags:7z MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: server1.profhost.nl
Sending IP: 217.119.4.32
From: "Standard Chartered Bank" <jr@coscoscargo.pw>
Reply-To: sjrkintluea@gmail.com
Subject: RFQ_Project (REFU, GmbH).
Attachment: RFQ.7z (contains "RFQ.exe")

MassLogger SMTP exfil server:
mail.ucfblr.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b73eb50389b6053796e922d764b9fd8b94d90d21c8c885ae265e6092ed971dd8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:20:43 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w47lka4jwyctpfxjellwjop5roknsdjbzdeillrglzqjf3mxdxma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

7z b73eb50389b6053796e922d764b9fd8b94d90d21c8c885ae265e6092ed971dd8

(this sample)

MassLogger

Executable exe b8892e7eafba52a3b311d7741d89363ec9d52b8d1fd180ea32385be609a6b9e8

  
Dropping
MD5 87e11aa7db38adec3ae9bdf63bc503a4
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8892e7eafba52a3b311d7741d89363ec9d52b8d1fd180ea32385be609a6b9e8

Comments